# --- required (the service refuses to start / serve without these) ---
ACDP_PII_HMAC_KEY=change-me-32+-random-bytes
ACDP_API_KEYS=admin-xxxxxxxxxxxxxxxxxxxx:admin,steward-xxxxxxxxxxxxxxxx:steward,viewer-xxxxxxxxxxxxxxxxx:viewer

# --- agent layer (default: deterministic, fully offline) ---
ACDP_LLM_PROVIDER=deterministic          # deterministic | anthropic | openai | local
# ACDP_LLM_MODEL=<model id>
# ACDP_LLM_BASE_URL=http://localhost:11434/v1   # any OpenAI-compatible server (vLLM, Ollama)
# ACDP_LLM_API_KEY=...
ACDP_LLM_PII_MODE=derived                # derived (masked shapes + computed comparisons) | raw

# --- connectors: secrets are referenced by env-var NAME in source config ---
# HUBSPOT_TOKEN=pat-...
# SALESFORCE_TOKEN=...
# SHOPIFY_TOKEN=shpat_...
# STRIPE_KEY=rk_live_...   (restricted key, read-only customers)
# ACDP_SEGMENT_SHARED_SECRET=...